TWI759138B - Threshold signature scheme system based on inputting password and method thereof - Google Patents

Abstract

A threshold signature scheme system based on inputting password and method thereof is disclosed. By assigning an X coordinate and a level value to a client and a server through a fair host. After setting a password on the client, the client and the server performing a distributed key generation (DKG) function based on secure multi-party computation (MPC), so as to generate a plurality of shares corresponding to the password according to the password, the X coordinate and the level value, and storing one of the shares into the server. When executing threshold signature scheme (TSS), just inputting the password on the client to regenerate the share corresponding to the password on the client, and executing the TSS together with the share of the server. The mechanism is help to improve the transaction security and management convenience of blockchain wallet.

Description

Threshold signature system and method based on input password

The invention relates to a signature system and a method thereof, in particular to a threshold type signature system and method based on an input password.

In recent years, with the popularization and vigorous development of blockchain, various improvement methods of blockchain technology have sprung up like mushrooms after rain. Among them, the security of the blockchain wallet is the most eye-catching.

Generally speaking, blockchain-based digital currencies are traded and signed through blockchain wallets. Traditional blockchain wallets store at least one set of key pairs (including public and private keys) for transaction purposes. When , use the private key to sign the transaction to prove that you are the legal owner of the digital currency, and then successfully execute the transaction. Therefore, in the era of the rising value of these digital currencies, how to ensure the security of the blockchain wallet is particularly important. The traditional way of directly storing the complete key pair in the blockchain wallet is that the key pair is easy to It is stolen or leaked, so there is a problem of insufficient security.

In view of this, some manufacturers have proposed a technical means of splitting and storing the private key with a secret sharing algorithm, which splits the private key into multiple shared units (Share) through the secret sharing algorithm, and allows the sharing of the private key in the unit. When the number of tokens meets the threshold value, a signature that conforms to the signature format is generated directly from these shared units through mathematical operations, without the need to combine private keys, thereby reducing the risk of private key leakage. However, this method has problems of inconvenient management and poor security. For example, when a web program is used to execute, the shared unit is usually stored in a "cookie", but its security is extremely low. In addition, when the carrier of the blockchain wallet (such as a computer, a smart phone, etc.) is lost, it may lead to the violent removal of the shared unit. Although only losing a single shared unit is not enough for signing, it still has its risks. It exists, and when the private key sharing unit is transmitted from the outside to the host, only relying on HTTPS encryption, it is very likely that the private key sharing unit is exposed due to phishing or various attack methods on the Internet. On the other hand, the actual holding of the shared unit has the trouble of management. In order to be able to trade at any time, it needs to be carried with you, which increases the probability of loss or leakage. Therefore, this method still cannot effectively solve the problems of insufficient transaction security and management convenience of blockchain wallets.

To sum up, it can be seen that there has been a long-standing problem of insufficient transaction security and management convenience of blockchain wallets in the prior art. Therefore, it is necessary to propose improved technical means to solve this problem.

The invention discloses a threshold type signature system and method based on the input password.

First, the present invention discloses a threshold-type signature system based on an input password, which is applied to a blockchain network including a plurality of nodes, and includes a fair end host, a client host and a server host. Among them, the fair-end host is one of the nodes, used to pre-allocate different X coordinates and level values to the nodes; the client host is one of the nodes, used to receive the X-coordinate and level values assigned by the fair-end host, The client host includes: a first generation module, a second generation module and a first operation module. Among them, the first generation module is used to allow the input of the password and the random selection of the b value, and the password is brought into the value calculated by the first hash function and multiplied by the b value to generate the P value and transmit it; the second generation module The first generation module is connected to receive the V value, and the product of the password, the reciprocal of the P value and the b value and the V value is brought into the integer value calculated by the second hash function as the client host and the corresponding password. and the first operation module is connected to the second generation module to execute the distributed key generation function based on Secure Multi-Party Computation (MPC), and convert the t value of the threshold signature , the value of n and the level value of the client host are brought into the distributed key generation function to generate the client shared unit of the client host and its corresponding threshold signature public key, where the client shared unit is equal to the cryptographic shared unit. Next, the server host, as one of the nodes, is used to receive the X coordinate and the level value assigned by the fair end host. The server host includes a key module, a second operation module and a storage module. Among them, the key module is used to generate an asymmetric private key and its corresponding public key after receiving the P value, randomly select the k value, and then use the product of the k value and the P value as the V value, and use The public key and V value are sent to the client host; the second computing module is used to execute a distributed key generation function based on secure multi-party computation, and convert the t value and n value of the threshold signature and the level value of the server host Bring in the distributed key generation function to generate the server-side sharing unit of the server-side host and correspond to the threshold-type signature public key; and the storage module is connected to the key module and the second computing module for storing the server-side Shared unit, k value, threshold signature public key, private key, and X-coordinate and level value of the server host and client host; where, when the client host and the server host execute threshold signature, the client Prompt for a password and re-select the b value randomly, and take the entered password into the first hash function The calculated value is multiplied by the re-selected b value to regenerate the P value, and transmit the regenerated P value to the servo The end host makes the server end host recalculate the V value and transmit it to the client host, and then the client host brings the product of the password, the regenerated P value, the reciprocal of the reselected b value and the recalculated V value into The second hash function regenerates the client shared unit of the client host, and then performs threshold signature on the transaction hash message according to the client shared unit regenerated by the client host and the server shared unit stored by the server host.

In addition, the present invention also discloses a threshold-type signature method based on inputting a password, which is applied to a blockchain network including a plurality of nodes. The host and the server host, the client host and the server host are pre-assigned the corresponding X coordinate and level value by the fair end host; the client host allows to input the password and randomly select the b value, and bring the password into the first hash The value calculated by the function is multiplied by the b value to generate the P value, and the P value is sent to the server host; after the server host receives the P value, it generates an asymmetric private key and its corresponding public key, And randomly select the k value, and then use the product of the k value and the P value as the V value, and transmit the public key and the V value to the client host; after receiving the V value, the client host sends the password, P value and b value. The product of the reciprocal and the V value is brought into the integer value calculated by the second hash function as the password sharing unit held by the client host and corresponding to the password; The key generation function, which brings the t value, n value and their respective level values of the threshold signature into the distributed key generation function to generate the client shared unit of the client host and the server shared unit of the server host, The client-side sharing unit is equal to the password-sharing unit, and generates a threshold-type signature public key corresponding to the client-side sharing unit and the server-side sharing unit; the server-side host stores the server-side sharing unit, k value, threshold-type signature public key, The private key, the X coordinate and level value of the server host and the client host; and when the threshold signature is executed, the client host prompts for a password and re-selects the b value randomly, and brings the entered password into the first hash function The value calculated by the formula is multiplied by the reselected b value to regenerate the P value, and the regenerated P value is transmitted to the server host, so that the server host recalculates the V value and transmits it to the client host, and then the client host The end host takes the product of the password, the regenerated P value, the reciprocal of the reselected b value, and the recalculated V value into the second hash function to regenerate the client shared unit of the client host, and then according to the client The client-side sharing unit regenerated by the host and the server-side sharing unit stored by the server-side host perform threshold signatures on the transaction hash message.

The system and method disclosed in the present invention are as above, and the difference from the prior art lies in that the present invention allocates X coordinates and level values to the client host and the server host through the fair host, and allows the client to set a password after the client host sets a password. The end host and the server end host execute a distributed key generation function based on secure multi-party computation to generate a shared unit corresponding to the password according to the password, X coordinate and level value and store it on the server end host. When the threshold signature is executed , the shared unit corresponding to the password can be regenerated on the client host only by inputting the password on the client host, and the threshold-type signature can be executed jointly with the shared unit stored in the server host.

Through the above technical means, the present invention can achieve the technical effect of improving the transaction security and management convenience of the blockchain wallet without generating a private key.

The embodiments of the present invention will be described in detail below in conjunction with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention applies technical means to solve technical problems and achieve technical effects.

First of all, before describing the password-based threshold signature system and method disclosed in the present invention, the application environment of the present invention is described first. The present invention is applied in a blockchain network, and in a blockchain network Each node of the network can perform secure multi-party computation to exchange data and computation results with each other, and then perform threshold signature. Next, for the self-defined nouns of the present invention, the first hash function of the present invention is a function to generate elliptic curve group (Elliptic Curve Group) elements according to a string or a byte array, and the second hash function A function is a function that generates an integer from a string or byte array. In addition, the shared unit (Share) in the present invention refers to an element generated by mutual exchange of data and calculation results between different nodes when performing secure multi-party computation, and this element can be used to calculate the digital data that conforms to the elliptic curve. The signature (or "signature") of the signature format of the signature algorithm (Elliptic Curve Digital Signature Algorithm, ECDSA), among which, the one generated based on the password is called the "password sharing unit", which is held by the client host. It is called "client-side shared unit", and the one held by the server host is called "server-side shared unit".

The following is a further description of the threshold type signature system based on inputting a password and the method of the present invention in conjunction with the drawings. Please refer to "Fig. 1" first. The block diagram is applied to the blockchain network 100 including a plurality of nodes. The system includes: an impartial end host 110 , a client end host 120 and a server end host 130 . The fair-end host 110 is one of the nodes, and is used to pre-allocate different X-coordinates and level values to the nodes. For example, peer host 110 may assign client host 120 an X coordinate of value 3 and a rank value of 0, and server host 130 an X coordinate of 5 and a rank value of 0. In addition, the client host 120 and the server host 130 can perform two-factor authentication or two-factor authentication (2FA) to verify the identity of the trader, thereby increasing the security of the transaction.

The client host 120, as one of the nodes, is used to receive the X coordinate and the level value assigned by the fair end host 110. The client host 120 includes: a first generation module 121, a second generation module 122 and a first operation Module 123. The first generation module 121 is used to allow input of a password and random selection of b value, and multiply the value calculated by the password into the first hash function and b value to generate a P value and transmit it. For example, if the user enters the password as "password" and the randomly selected b value is 8, the calculation method of the P value is "Hash(password) * 8", where "Hash()" represents the first hash function, and "Hash(password)" is a point on the elliptic curve.

The second generation module 122 is connected to the first generation module 121 to receive the V value from the server host 130, and bring the password, the P value, and the product of the reciprocal of the b value and the V value into the second hash function to calculate The integer value of , as the shared unit of the password held by the client host and corresponding to the password. Compared with the first generation module 121 using the first hash function, the second generation module 122 uses the second hash function to calculate the shared unit corresponding to the password (ie, the password shared unit "share-pw"), That is to say, the calculation method of the password sharing unit is "Hash'(password, P, 8 ^-1 * V)", where "Hash'()" is the second hash function, "password" is the password, "P" is the P value, “8 ⁻¹ ” is the reciprocal of the b value, and “V” is the V value received from the server host 130 . In practice, the client host 120 can also receive the public key from the server host 130, and use the public key to encrypt its own password, so as to store the encrypted password in the cloud hard disk for backup. In this way, when the user forgets the password, he can request the corresponding private key from the server host 130 to decrypt it, thereby obtaining the password.

The first operation module 123 is connected to the second generation module 122, and is used for executing a distributed key generation function based on secure multi-party computation, and brings the t value, n value of the threshold signature and the level value of the client host into the distributed key generation function. A key generation function is used to generate the client shared unit of the client host and its corresponding threshold-type signature public key, wherein the client shared unit is equal to the password shared unit. In actual implementation, the t value of the threshold signature represents the threshold value, and the n value represents the number of all nodes participating in the signature operation. For example, when the nodes participating in the threshold signature are the client host 120 and the server host 130 When there are only two hosts, the n value is the value 2. In addition, when the value of t is 2, it means that at least two hosts (in this example, the client host 120 and the server host 130 , respectively) with matching shared units are required to complete the signature.

Next, the server host 130 is used as one of the nodes to receive the X coordinate and the level value assigned by the fair host 110. The server host 130 includes: a key module 131, a second operation module 132 and a storage module Group 133. The key module 131 is used to generate an asymmetric private key and its corresponding public key after receiving the P value, randomly select the k value, and then use the product of the k value and the P value as the V value, and Send the public key and V value to the client host. The method of randomly selecting the value of k here is similar to the method in which the client host 120 randomly selects the value of b. Assuming that the value of k is 100, the value of V is obtained by multiplying the value of P received from the client host 120 by the value of k, namely: "V = 100 * P", and then transmit the generated public key and the V value to the client host 120 .

The second computing module 132 is used for executing the distributed key generation function based on secure multi-party computation, and brings the t value, n value of the threshold signature and the level value of the server host into the distributed key generation function to generate The server-side shared unit of the server-side host corresponds to the threshold-type signature public key. In actual implementation, the t value, n value of the threshold signature and the level value of the server host are brought into the distributed key generation function mainly to select the appropriate first polynomial. The computation performed by the scatter is that the key generation function consists of the following steps:

1. The client host 120 and the server host 130 exchange their respective X coordinates with each other. Assuming that the X coordinate of the client host 120 is the value 3, and the X coordinate of the server host 130 is the value 5, after the mutual exchange, the client host 120 will know the X coordinate of the server host 130. Similarly, the server host 130 also The X coordinate of the client host 120 will be known.

2. The client host 120 randomly selects the first polynomial according to the t value, the n value and the level value, and the server host randomly selects the second polynomial, the first polynomial and the third polynomial according to the t value, the n value and the level value. The highest degree of the second polynomial is the t value minus the value 1, and the X coordinate of the client host 120 is brought into the first polynomial and the second polynomial to calculate the first polynomial value and the second polynomial value, respectively. polynomial value (ie: the client host 120 brings its own X coordinate into the first polynomial, and the server host 130 brings the X coordinate of the client host 120 into the first polynomial), wherein the randomly selected The first polynomial needs to satisfy that the first polynomial value is equal to the password sharing unit, and the randomly selected second polynomial needs to satisfy that the second polynomial value is zero. In other words, assuming the first polynomial is "f _user (x)" and the second polynomial is "f _server (x)", then, "f _user (3) = share-pw", "f _server (x)" (3) = 0".

3. The client host 120 and the server host 130 bring their own X-coordinates into the first polynomial or second polynomial selected by themselves to calculate the corresponding third polynomial value, and add the other party's X-coordinate Bring in the first polynomial or second polynomial selected by itself to calculate the corresponding fourth polynomial value, and the calculated fourth polynomial value "f _user (5) by the client host 120 ” is sent to the server host 130 . It should be noted that, since the second polynomial needs to satisfy the value of the second polynomial value of zero, the value transmitted by the server host 130 must be zero. Therefore, in this step, the server host 130 does not need to transmit the known value zero to the client host 120 , but only the client host 120 transmits “f _user (5)” to the server host 130 . In the above example, the client host 120 would get "f _user (3)", and the server host would get "f _user (5)" and "f _server (5)". That is to say, the third polynomial value refers to the value obtained by bringing its own X coordinate into the polynomial selected by itself. For example, the third polynomial value obtained by the client host 120 is “f _user (3)” , and the third polynomial value obtained by the server host 130 is "f _server (5)", and the fourth polynomial value is the value obtained by bringing the opponent's X coordinate into the polynomial selected by itself, such as: The fourth polynomial value obtained by the end host 130 is "f _server (3)", and the fourth polynomial value obtained by the client host 120 is "f _user (5)".

4. The client host 120 and the server host 130 respectively bring the value zero into the first polynomial or the second polynomial selected by themselves to calculate the corresponding fifth polynomial value, and then add the calculated first polynomial value to the second polynomial value. The value of the five polynomials is multiplied by the base point "G" of the elliptic curve group to calculate the corresponding exchange value, and the zero-knowledge proofs (Zero-Knowledge Proofs) corresponding to the cryptographic sharing unit and the server-side sharing unit are generated and exchanged with each other. For example, the fifth polynomial value calculated by the client host 120 is "f _user (0) * G", and the fifth polynomial value calculated by the server host 130 is "f _server (0) * G"", after the exchange, the client host 120 will get "f _server (0) * G", and the server host 130 will get "f _user (0) * G". So far, the client host 120 has obtained "f _user (3)" and "f _server (0) * G", and the server host 130 has obtained "f _user (5)", "f _server (5)" and "f" _user (0) * G".

5. The client host 120 sets the third polynomial value calculated by itself as the client shared unit, and the server host 130 sets the third polynomial value calculated by itself and the received fourth polynomial value Add up to calculate the corresponding server-side sharing unit, and verify the zero-knowledge proof and calculate the corresponding client-side sharing unit and the server-side sharing unit according to the exchange value and the Birkhoff coefficient of the client host 120 and the server host 130. Threshold signature public key. For example, the client host 120 will set "f _user (3)" as the shared unit of the client, which is equal to the password sharing unit "share-pw", and the server host 130 will set "f _user (5)" Add "f _server (5)" to get the server-side shared unit "s _server ". The calculation method of the public key is "b _user f _user (0) * G + b _server f _server (0) * G", where b refers to the Birkhoff coefficient.

The storage module 133 is connected to the key module 131 and the second operation module 132 for storing the server-side shared unit, the k value, the threshold signature public key, the private key, and the X of the server-side host 130 and the client host 120 Coordinates and level values. In practical implementation, the storage module 133 can be implemented by using a hard disk, an optical disk, a non-volatile memory, a database, and the like.

It should be added that since the client host 120 does not need to store any data, when the client host 120 and the server host 130 execute the threshold signature, the client host 120 will prompt to enter a password and randomly select the b value again. And bring the input password into the value calculated by the first hash function and multiply the reselected b value to regenerate the P value, and transmit the regenerated P value to the server host 130, so that the server host 130 regenerates the value. Calculate the V value and transmit it to the client host 120, and then the client host 120 takes the password, the regenerated P value, the product of the reciprocal of the reselected b value and the recalculated V value into the second hash function to obtain The client shared unit of the client host 120 is regenerated, and the threshold signature is performed on the transaction hash message according to the client shared unit regenerated by the client host 120 and the server shared unit stored by the server host 130 .

It should be noted that, in practice, the modules described in the present invention can be implemented in various ways, including software, hardware, or any combination thereof. For example, in some embodiments, each module can be implemented by using Software and hardware or one of them can be implemented. In addition, the present invention can also be implemented partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), Complex Programmable Logic Device (Complex Programmable Logic Device, CPLD), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) etc. The present invention may be a system, method and/or computer program. The computer program may include a computer-readable storage medium on which computer-readable program instructions for causing a processor to implement various aspects of the present invention are loaded, and the computer-readable storage medium may be a tangible material that may hold and store instructions for use by the instruction execution device equipment. Computer-readable storage media can be, but are not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (eg, optical signals through fiber optic cables), or through electrical wires. transmitted electrical signals. Additionally, the computer-readable program instructions described herein may be downloaded from computer-readable storage media to various computing/processing devices, or downloaded over a network such as the Internet, a local area network, a wide area network, and/or a wireless network to an external computer device or external storage device. Networks may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on the computer-readable storage medium in each computing/processing device middle. The computer program instructions that perform the operations of the present invention may be assembled language instructions, instruction set architecture instructions, machine instructions, machine dependent instructions, microinstructions, firmware instructions, or source or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as: C language or similar programming language. The computer program instructions may execute entirely on the computer, partly on the computer, as a stand-alone software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server execute on.

Please refer to "Fig. 2A" and "Fig. 2B", "Fig. 2A" and "Fig. 2B" are flow charts of the method of the threshold-type signature method based on the input password of the present invention, which is applied to a region including a plurality of nodes The steps of the blockchain network 100 include: providing a fair host 110, a client host 120 and a server host 130 as nodes of the blockchain network 100, and the client host 120 and the server host 130 are all provided by fair The end host 110 pre-assigns the corresponding X coordinate and level value (step 211 ); the client host 120 allows the input of the password and randomly selects the b value, and brings the password into the value calculated by the first hash function and multiplies the b value by Generate a P value, and transmit the P value to the server host 130 (step 212 ); after receiving the P value, the server host 130 generates an asymmetric private key and its corresponding public key, and randomly selects the k value, Then the product of the k value and the P value is used as the V value, and the public key and the V value are transmitted to the client host 120 (step 213 ); after the client host 120 receives the V value, the password, the P value and the b value are sent to the client host 120 . The product of the reciprocal of V and the value of V is brought into the integer value calculated by the second hash function as the password sharing unit held by the client host 120 and corresponding to the password (step 214 ); the client host 120 and the server host 130 use The secure multi-party computation executes the distributed key generation function, and brings the t value, n value and the respective level values of the threshold signature into the distributed key generation function to generate the client shared unit and the server of the client host 120 The server-side sharing unit of the end host 130, wherein the client-side sharing unit is equal to the password sharing unit, and generates a threshold-type signature public key corresponding to the client-side sharing unit and the server-side sharing unit (step 215); the server-side host 130 stores the server end-shared unit, k value, threshold signature public key, private key, and X-coordinate and level value of server end host 130 and client host 120 (step 216 ); and when threshold signature is performed, client host 120 Prompt for a password and re-select the b value randomly, and take the entered password into the first hash function The calculated value is multiplied by the re-selected b value to regenerate the P value, and transmit the regenerated P value to the servo The end host 130 makes the server end host 130 recalculate the V value and transmit it to the client host 120, and then the client host 120 calculates the password, the regenerated P value, the reciprocal of the reselected b value, and the recalculated V value. The product of , is brought into the second hash function to regenerate the client shared unit of the client host 120 , and the transaction hash message is then hashed according to the client shared unit regenerated by the client host 120 and the server shared unit stored by the server host 130 Threshold signature is performed (step 217). Through the above steps, the client host 120 and the server host 130 can be assigned the X coordinate and the level value through the fair host 110, and after the client host 120 sets the password, the client host 120 and the server host 130 can be based on the The secure multi-party computation executes the distributed key generation function to generate the shared unit corresponding to the password according to the password, the X coordinate and the level value and store it in the server host 130. When the threshold signature is executed, only the client The host 120 can regenerate the shared unit corresponding to the password on the client host 120 by inputting the password, and jointly execute the threshold signature with the shared unit stored in the server host 130 .

The following description will be given in the form of an embodiment in conjunction with "Fig. 3" and "Fig. 4", please refer to "Fig. 3", "Fig. 3" is the application of the present invention to the client host to set a password and enter a password to sign Schematic diagram of the chapter. Initially, the fair-side host 110 will assign an X coordinate and its corresponding level value to each node participating in the operation. For example, the X-coordinate assigned by the client host 120 is a value of 3 and the level value is a value of 0; the server-side host 130 The assigned X coordinate is value 5 and the level value is value 0.

The client host 120 allows the user to input a custom password in the input block 310 of the generation window 300 to generate the corresponding shared unit. When the user clicks the generate shared unit button 320, the client host 120 will randomly select a value (ie: b value), for example: the value 8. At this point, the client host will calculate the P value, such as: "P = Hash(password) * 8". Among them, "password" represents the password entered by the user in the input block 310, and "Hash( )" represents the first hash function. When the first hash function is executed and the password is brought in, it can be multiplied by the b value. Get a P value. After calculating the P value, the client host 120 transmits the P value to the server host 130, so that the server host 130 generates an asymmetric private key and its corresponding public key, and randomly selects the k value, and then uses the The product of the k value and the P value is used as the V value. For example, if the value of K is 100, the value of V is calculated as "V = 100 * P"). Then, the public key and V value are transmitted to the client host.

After the client host 120 receives the V value from the server host 130, it executes the second hash function according to the product of the password, the P value, and the b value and the received V value to generate an integer value as its own shared unit. For example, the calculation method is "share-pw = Hash'(pw,P,8 ^-1 * V)". Among them, "share-pw" represents the shared unit corresponding to the password (ie: password sharing unit); "Hash'()" represents another hash function (ie: the second hash function); "pw" represents the input Password; "P" represents the P value; " ^8-1 " represents the reciprocal of the b value; "V" represents the V value. In actual implementation, the public key provided by the server host 130 may be used to encrypt your own password, and then store it in a different place (eg, a cloud hard disk) as a backup.

Next, the client host 120 randomly selects a polynomial (ie: the first polynomial "f _user (x)"), and the highest degree of the first polynomial is the threshold value of the threshold signature (ie: t value) Subtract the value by 1. For example, assuming that the threshold value is a value of "2", the highest degree of the first polynomial is a value of "1", which means that the first polynomial is a first-order polynomial. In addition, the polynomial value calculated by bringing the X coordinate into the first polynomial (ie: the first polynomial value) needs to be equal to the password sharing unit. Taking the X coordinate as the value of 3 as an example, the first A polynomial satisfies "f _user (3) = share-pw". In addition, the server host 130 will also randomly select a polynomial (ie: the second polynomial "f _server (x)"), the highest degree of the second polynomial is also the threshold value minus 1, and it satisfies the client The X coordinate of the end host 120 is brought into the second polynomial and the calculated polynomial value (that is, the second polynomial value) is zero. Similarly, taking the X coordinate as the value 3 as an example, it represents "f _server (3) = 0".

Next, the client host 120 and the server host 130 will bring their own X-coordinates into the polynomial value (ie, the third polynomial value) selected by themselves, and perform secure multi-party computation to exchange their own X-coordinates with each other, so that Bring the X coordinate of the opponent into the polynomial value of your choice (ie: the fourth polynomial value), and also bring the value zero into the polynomial value of your choice (ie: the fifth polynomial value), and then Multiply the fifth polynomial value by the base point "G" of the elliptic curve group to calculate the exchange value (ie: "f _user (0) * G " and "f _server (0) * G") and generate and password The corresponding zero-knowledge proofs of the shared unit and the server-side shared unit are exchanged with each other. In this example, the client host 120 performing secure multi-party computation will get "f _user (3)" and "f _server (0) * G"; the server host 130 will get "f _user (5)", "f _server (5)” and “f _user (0) * G”.

After the client host 120 obtains the third polynomial value and the exchange value, and the server host 130 obtains the third polynomial value, the fourth polynomial value and the exchange value, the client host 120 sends the third polynomial value to the exchange value. As a client shared unit, the server host 130 adds the third polynomial value and the received fourth polynomial value to calculate the corresponding server shared unit, and the client host 120 and the server host 130 verify Zero-knowledge proof and calculation of the public key corresponding to the shared unit (ie: threshold signature public key) according to the exchange value and Birkhoff coefficient. For example, the shared unit (ie, the client shared unit) calculated by the client host 120 is "f _user (3)"; the shared unit (ie, the server shared unit) calculated by the server host 130 is "f user (3)" _user (5) + f _server (5)”; the threshold-type signature public key is “b _user f _user (0) * G + b _server f _server (0) * G”. Among them, "b _user " and "b _server " refer to the Birkhoff coefficient.

At this time, the server host 130 will store the shared unit “s _server ” of the server host 130 , the K value, the threshold signature public key, the private key used to decrypt the password, and all the X coordinates and their corresponding level values, and The client host 120 does not need to store any data. In fact, the client host 120 can also transmit its own password encrypted with the public key to the cloud for backup use. So far, the server host 130 has a shared unit corresponding to the password, that is, the server shared unit, which can jointly sign the transaction hash message when the client host 120 also has a client shared unit corresponding to the password.

When the client host 120 and the server host 130 need to perform a threshold signature, a signature window 350 will be displayed on the client host 120 to prompt the user to input the previously set password in the input block 360. When the user enters the password and When the signature element 370 is clicked, the client host 120 will randomly select the b value, for example, the value of 10. Then, the client host takes the password entered by the user in the input block 360 into the first hash function, and multiplies the calculated value by the re-randomly selected b value to regenerate the P value (ie : "P = Hash(password) * 10"), and transmits the regenerated P value to the server host 130, so that the server host 130 receives and receives the value of k according to the value of k (in the above example, the value of k is assumed to be a value of 100) The obtained P value recalculates the V value (ie: "V = 100 * P"). Next, the server host 130 not only transmits the recalculated V value to the server host 130 , but also transmits the stored X coordinate (x _user ) of the client host 120 and the threshold signature public key to the client end host 120.

After the client host 120 receives its recalculated V value from the server host 130, it brings the password, the regenerated P value, the reselected b value, and the V value recalculated by the server host 130 into the second Hash function to regenerate the shared unit of client host 120 (ie: client shared unit). In this way, the client host 120 can use the regenerated shared unit to match the shared unit stored in the server host 130 corresponding to the password, that is, the server shared unit "s _server ", to perform secure multi-party computation for transactions. Hash messages are subject to threshold signatures.

As shown in "Fig. 4", "Fig. 4" is a schematic diagram of applying the present invention to a client host to change a password and its corresponding client-side sharing unit and server-side sharing unit. In practice, the client host 120 and the server host 130 are allowed to execute a password change function based on secure multi-party computation to replace the old password with the new password. For example, when the user wants to change the password, the client host 120 allows to input the old password and the new password in the password change window 400 , for example, input the old password in the input block 410 and input the new password in the input block 420 . Next, after the user clicks the determining element 430, the client host 120 randomly selects two values, ie, the b1 value and the b2 value. Suppose that after selecting the value of 10 and the value of 8, the client host 120 respectively brings the new password and the old password into the first hash function to calculate the old P value respectively (ie: "P _old = Hash(password _old ) * 10 ) ") and the new P value (ie: "P _new = Hash(password _new ) * 8"), and transmit the calculation result to the server host 130 .

After that, the server host 130 calculates the old V value (V _old = 100 * P _old ) according to the old k value “k _old ” (in the above example, it is assumed to be a value of 100) and the old P value of the client host 120 , and A new k value "k _new " (assuming a value of 200) is randomly generated to calculate a new V value (V _new = 200 * P _new ) based on the new P value and the new k value. Then, the old V value, the new V value and the public key are communicated to the client host 120 .

Next, after the client host 120 receives the old V value and the new V value, the old password, the old P value, and the product of the reciprocal of the b1 value "10" and the old V value are brought into the second hash function to calculate the old V value. shared unit (ie: "share-pw _old = Hash'(pw _old , P _old , 10 ^-1 * V _old )"), and the new password, the new P value and the inverse of the b2 value "8" with the new V value The product of is taken into the second hash function to calculate the new shared unit (ie: "share-pw _new = Hash'(pw _new , P _new , 8 ^-1 * V _new )").

Next, the client host 120 randomly selects a polynomial of degree t-1 "f _user (x) = ((share-pw _new - b _user * share - pw _old ) / 3) * (x - 3) + share - pw _new ". Similarly, the server host 130 also randomly selects a polynomial of degree t-1 "f _server (x) = - (b _server * s _server ) / 3) * (x - 3)", where "t" refers to t value or threshold value. Then, the client host 120 and the server host 130 bring the X coordinate of each other into the polynomial value selected by themselves (ie: the fourth polynomial value), and also bring the value zero into the polynomial value selected by themselves ( That is: the fifth polynomial value), and then multiply the fifth polynomial value by the base point "G" of the elliptic curve group to calculate the corresponding exchange value (ie: "f _user (0) * G " and " f _server (0) * G"), and exchange the calculated fourth polynomial value, the exchange value, and the product of the shared unit of the corresponding old cipher with the base point "G" (ie: "share-pw _old * G") is sent to the server host 130, and the client will generate a zero-knowledge proof about "share-pw _old " and "share-pw _new " and the server will generate a zero-knowledge proof about "s _server " to ensure that both parties Is to know their own secrets, namely: "share-pw _old ", "share-pw _new " and "s _server " (the standard Schnorr protocol can be used here for this purpose). In this example, a client host 120 performing secure multiparty computation would get "f _user (3)" and "f _server (0) * G" and two for "share-pw _old " and "share-pw _new " _{The zero} - _{knowledge proof of} ” zero-knowledge proof.

After the client host 120 and the server host 130 obtain the above calculation results, the client host 120 sets "f _user (3)" as a new shared unit corresponding to the new password, that is, the client new shared unit "share-pw _new "”; the server host 130 adds up “f _user (5)” and “f _server (5)” to calculate a new shared unit of the server host 130 , that is, a new server shared unit “s _server-new ”. At the same time, the client host 120 and the server host 130 will calculate a new threshold-type signature public key (ie: a new threshold-type signature public key), and the calculation method is "b _user f _user (0) * G + b _server f _server (0) * G", where "b _user " and "b _server " are the Birkhoff coefficients of the client host 120 and the server host 130, respectively, and the method of verifying the threshold signature public key can be based on " b1 * share-pw _old * G + b2 * s _server * G" and "b1 * share-pw _new * G + b2 * s _server-new * G", where "b1" and "b2" is the corresponding computable Birkhoff coefficient and the zero-knowledge proof received by the respective verification. So far, as long as no one knows the two shared units of the client host 120 and the server host 130 at the same time, after the password is replaced, the originally owned single shared unit can be invalidated.

In other words, the client host 120 and the server host 130 allow a secure multi-party computation-based replacement password function, which may include the following steps:

1. The client host 120 prompts for a password and a new password, and randomly selects the b1 value and the b2 value, then takes the password into the first hash function and multiplies the b1 value to calculate the old P value, and adds the new password to the first hash function. Enter the first hash function and multiply the b2 value to calculate the new P value, and transmit the old P value and the new P value to the server host 130 .

2. The server host 130 multiplies the k value and the old P value to calculate the old V value, and multiplies the randomly generated new k value and the new P value to calculate the new V value, and transmits the old V value, the new The V value and the public key are sent to the client host 120 .

3. The client host 120 takes the product of the password, the old P value, the reciprocal of the b1 value and the old V value into the second hash function to calculate the old password sharing unit, and combines the new password, the new P value, and the b2 value. The product of the reciprocal and the new value of V is brought into the second hash function to calculate the new cryptographic sharing unit.

4. The client host 120 and the server host 130 bring the old password sharing unit, the new password sharing unit, the t value, n value of the threshold signature, and their respective level values into the distributed key generation function to generate the client The client new shared unit of the host 120 and the server new shared unit of the server host 130, and the original server shared unit is replaced with the server new shared unit, and the new shared unit of the client and the new shared unit of the server are generated corresponding to The new threshold signing public key for .

From the above, it can be seen that the difference between the present invention and the prior art is that the client host and the server host are assigned the X coordinate and the level value through the fair end host, and after the client host sets a password, the client host and the The server-side host executes the distributed key generation function based on secure multi-party computation to generate a shared unit corresponding to the password according to the password, X-coordinate and level value and store it on the server-side host. Entering the password on the client host can regenerate the shared unit corresponding to the password on the client host, and jointly execute the threshold-type signature with the shared unit stored in the server host. This technical means can solve the existing problems in the prior art. Therefore, the technical effect of improving the transaction security and management convenience of the blockchain wallet can be achieved without generating a private key.

Although the present invention is disclosed above by the aforementioned embodiments, it is not intended to limit the present invention. Anyone who is familiar with the similar arts can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

100: Blockchain Network 110: Fair end host 120: client host 121: The first generation module 122: Second Generation Module 123: The first operation module 130: Server host 131: Key Module 132: The second operation module 133: Storage Module 300: Generate viewport 310: Input block 320: Generate shared unit keys 350:Signature window 360: input block 370:Signature element 400: Change password window 410,420: Input block 430: Determine Components Step 211: Provide a fair host, a client host and a server host as nodes of the blockchain network, the client host and the server host are pre-assigned a corresponding X coordinate by the fair host and one-level value Step 212: The client host allows input of a password and randomly selects a b value, and takes the password into a value calculated by a first hash function and multiplies the b value to generate a P value, and the P value sent to the server host Step 213: After the server host receives the P value, it generates an asymmetric private key and a corresponding public key, and randomly selects a k value, and then uses the product of the k value and the P value as a V value, and transmitting the public key and the V value to the client host Step 214: After receiving the V value, the client host takes the password, the product of the reciprocal of the P value and the b value and the V value into an integer value calculated by a second hash function as the client A cipher sharing unit held by the end host and corresponding to the cipher Step 215: The client host and the server host execute a distributed key generation function through Secure Multi-Party Computation (MPC), and generate a value t, a value n of the threshold signature and their respective The level value of is brought into the distributed key generation function to generate a client shared unit of the client host and a server shared unit of the server host, wherein the client shared unit is equal to the cryptographic shared unit, and generating a threshold-type signature public key corresponding to the client-side sharing unit and the server-side sharing unit Step 216: The server host stores the server shared unit, the k value, the threshold signature public key, the private key, the X coordinate and the level value of the server host and the client host Step 217: When the threshold signature is executed, the client host prompts for the password and re-selects the b value randomly, and brings the entered password into the value calculated by the first hash function and the re-selected value of b. The b value is multiplied to regenerate the P value, and the regenerated P value is transmitted to the server host, so that the server host recalculates the V value and transmits it to the client host, and then the client host recalculates the V value. The product of the password, the regenerated P value, the reciprocal of the reselected b value and the recalculated V value is brought into the second hash function to regenerate the client shared unit of the client host, Then, according to the client-side sharing unit regenerated by the client-side host and the server-side sharing unit stored by the server-side host, a threshold signature is performed on a transaction hash message

Fig. 1 is a system block diagram of the threshold type signature system based on the input password of the present invention. FIG. 2A and FIG. 2B are method flow charts of the threshold type signature method based on the input password of the present invention. FIG. 3 is a schematic diagram of applying the present invention to set a password on a client host and input the password for signing. FIG. 4 is a schematic diagram of applying the present invention to a client host to change a password and its corresponding client-side sharing unit and server-side sharing unit.

100: Blockchain Network

110: Fair end host

120: client host

121: The first generation module

122: Second Generation Module

123: The first operation module

130: Server host

131: Key Module

132: The second operation module

133: Storage Module

Claims (10)

A threshold type signature system based on input password, applied in a blockchain network including multiple nodes, the system includes: a fair-end host, as one of the nodes, for pre-allocating a different X-coordinate and a level value to the node; A client host, as one of the nodes, is used to receive the X coordinate and the level value assigned by the fair end host, and the client host includes: A first generation module for allowing input of a password and randomly selecting a b value, and bringing the password into a first hash function to calculate a value and multiplying the b value to generate a P value and transmit it ; A second generation module, connected to the first generation module, for receiving a V value, and bringing the password, the P value and the product of the reciprocal of the b value and the V value into a second hash function the computed integer value as a cryptographic share unit held by the client host and corresponding to the cryptogram; and A first computing module, connected to the second generation module, is used to execute a distributed key generation function based on Secure Multi-Party Computation (MPC), and converts a t value of the threshold signature, A value of n and the level value of the client host are brought into the distributed key generation function to generate a client shared unit of the client host and a corresponding threshold signing public key, wherein the client The shared unit is equal to the cryptographic shared unit; and A server host, as one of the nodes, is used to receive the X coordinate and the level value assigned by the fair end host, and the server host includes: a key module for generating an asymmetric private key and a corresponding public key after receiving the P value, randomly selecting a k value, and then multiplying the k value and the P value as the V value, and transmitting the public key and the V value to the client host; A second computing module for executing the distributed key generation function based on secure multi-party computation, and bringing the t value, the n value of the threshold signature and the level value of the server host into the distributed key generation function key generation function to generate a server-side shared unit of the server-side host corresponding to the threshold signing public key; and a storage module, connected to the key module and the second computing module, for storing the server-side sharing unit, the k value, the threshold signature public key, the private key, the server-side host and the The X coordinate of the client host and the level value; Wherein, when the client host and the server host execute the threshold signature, the client host prompts to input the password and re-selects the b value randomly, and brings the inputted password into the first hash function to calculate The value obtained is multiplied by the reselected b value to regenerate the P value, and the regenerated P value is transmitted to the server host, so that the server host recalculates the V value and transmits it to the client host , then the client host brings the password, the regenerated P value, the product of the reciprocal of the reselected b value and the recalculated V value into the second hash function to regenerate the client The client-side sharing unit of the host computer performs threshold signature on a transaction hash message according to the client-side sharing unit regenerated by the client-side host and the server-side sharing unit stored in the server-side host. The threshold signature system based on input password of claim 1, wherein the first hash function generates an elliptic curve group according to a string or a byte array, and the second hash function is based on a string or a byte array Group array yields an integer. For the threshold signature system based on input password of claim 1, wherein the client host encrypts the password with the received public key and stores it in a cloud hard disk for backup, when the password is forgotten, the client The host downloads the encrypted password from the cloud hard disk, and receives the private key from the server host to decrypt the encrypted password. The threshold signature system based on input password of claim 1, wherein the distributed key generation function includes: The client host and the server host exchange the respective X-coordinates with each other; The client host randomly selects a first polynomial according to the t value, the n value and the level value, and the server host randomly selects a second polynomial according to the t value, the n value and the level value, The highest degree of the first polynomial and the second polynomial is the t value minus a value of 1, and the X-coordinate of the client host is brought into the first polynomial and the second polynomial, respectively to calculate a first polynomial value and a second polynomial value respectively, wherein the randomly selected first polynomial must satisfy that the first polynomial value is equal to the password sharing unit, and the randomly selected The second polynomial needs to satisfy that the second polynomial value is zero; The client host and the server host bring their own X-coordinates into the first polynomial or the second polynomial selected by themselves to calculate a corresponding third polynomial value, and transfer each other's The X coordinate is brought into the first polynomial or the second polynomial selected by itself to calculate a corresponding fourth polynomial value, and the client host will calculate the fourth polynomial value is sent to the server host; The client host and the server host respectively bring the value zero into the first polynomial or the second polynomial selected by themselves to calculate a corresponding fifth polynomial value, and then use the calculated value The fifth polynomial value is multiplied by a base point of the elliptic curve group to respectively calculate a corresponding exchange value and generate a zero-knowledge proof corresponding to the cryptographic sharing unit and the server-side sharing unit and exchange them with each other; and The client host sets the third polynomial value calculated by itself as the client sharing unit, and the server host sets the third polynomial value calculated by itself and the received fourth polynomial value as the client sharing unit Add the formula values to calculate the corresponding shared unit of the server, and verify the zero-knowledge proof and calculate the shared unit with the client according to the exchange value and a Birkhoff coefficient of the client host and the server host and the threshold signature public key corresponding to the server-side sharing unit. For the threshold signature system based on input password of claim 1, wherein the client host and the server host are allowed to execute a password change function based on secure multi-party computation to replace the password with a new password, the replacement The cipher function contains: The client host prompts for the password and the new password, and randomly selects a b1 value and a b2 value, and then takes the password into the first hash function and multiplies the b1 value to calculate an old P value , and bring the new password into the first hash function and multiply the b2 value to calculate a new P value, and transmit the old P value and the new P value to the server host; The server-side host multiplies the k value by the old P value to calculate an old V value, and multiplies a randomly generated new k value by the new P value to calculate a new V value, and transmits the the old V value, the new V value and the public key to the client host; The client host takes the password, the old P value, the product of the reciprocal of the b1 value and the old V value into the second hash function to calculate an old password sharing unit, and the new password, the new The product of the P value, the inverse of the b2 value, and the new V value is brought into the second hash function to calculate a new cryptographic sharing unit; and The client host and the server host bring the old password sharing unit, the new password sharing unit, the t value of the threshold signature, the n value and the respective level value into the distributed key generation function generating a client new shared unit of the client host and a server new shared unit of the server host, and replacing the server shared unit stored in the storage module with the server new shared unit, and generating A new threshold-type signature public key corresponding to the new shared unit of the client and the new shared unit of the server. A threshold-type signature method based on an input password is applied to a blockchain network including multiple nodes, and the steps include: A fair host, a client host and a server host are provided as the nodes of the blockchain network, and the client host and the server host are pre-assigned a corresponding X coordinate by the fair host and a level value; The client host allows input of a password and randomly selects a b value, and takes the password into a first hash function and multiplies the value calculated by the b value to generate a P value, and transmits the P value to the server host; After receiving the P value, the server host generates an asymmetric private key and a corresponding public key, randomly selects a k value, and then uses the product of the k value and the P value as a V value, and transmitting the public key and the V value to the client host; After receiving the V value, the client host takes the product of the password, the P value and the reciprocal of the b value and the V value into an integer value calculated by a second hash function as the client host There is a password sharing unit corresponding to the password; The client host and the server host execute a distributed key generation function through Secure Multi-Party Computation (MPC), and convert a value of t, a value of n of the threshold signature and their respective levels. The value is brought into the distributed key generation function to generate a client shared unit of the client host and a server shared unit of the server host, wherein the client shared unit is equal to the cryptographic shared unit, and the A threshold-type signature public key corresponding to the client-side sharing unit and the server-side sharing unit; the server host stores the server shared unit, the k value, the threshold signature public key, the private key, and the X-coordinate and the level value of the server host and the client host; and When performing threshold signature, the client host prompts for the password and re-selects the b value randomly, and brings the entered password into the first hash function to calculate a value that is consistent with the re-selected b value Multiply and regenerate the P value, and transmit the regenerated P value to the server host, so that the server host recalculates the V value and transmits it to the client host, and then the client host uses the password, The product of the regenerated P value, the reciprocal of the reselected b value and the recalculated V value is brought into the second hash function to regenerate the client shared unit of the client host, and then according to the The client-side sharing unit regenerated by the client-side host and the server-side sharing unit stored by the server-side host perform threshold signatures on a transaction hash message. The threshold signature method based on the input password of claim 6, wherein the first hash function generates an elliptic curve group according to a string or a byte array, and the second hash function is based on a string or a byte array Group array yields an integer. According to the threshold signature method based on the input password of claim 6, wherein the client host encrypts the password with the received public key and stores it in a cloud hard disk for backup, when the password is forgotten, the client The host downloads the encrypted password from the cloud hard disk, and receives the private key from the server host to decrypt the encrypted password. The threshold signature method based on the input password of claim 6, wherein the distributed key generation function includes: The client host and the server host exchange the respective X-coordinates with each other; The client host randomly selects a first polynomial according to the t value, the n value and the level value, and the server host randomly selects a second polynomial according to the t value, the n value and the level value, The highest degree of the first polynomial and the second polynomial is the t value minus a value of 1, and the X-coordinate of the client host is brought into the first polynomial and the second polynomial, respectively to calculate a first polynomial value and a second polynomial value respectively, wherein the randomly selected first polynomial must satisfy that the first polynomial value is equal to the password sharing unit, and the randomly selected The second polynomial needs to satisfy that the second polynomial value is zero; The client host and the server host bring their own X-coordinates into the first polynomial or the second polynomial selected by themselves to calculate a corresponding third polynomial value, and transfer each other's The X coordinate is brought into the first polynomial or the second polynomial selected by itself to calculate a corresponding fourth polynomial value, and the client host will calculate the fourth polynomial value is sent to the server host; The client host and the server host respectively bring the value zero into the first polynomial or the second polynomial selected by themselves to calculate a corresponding fifth polynomial value, and then use the calculated value The fifth polynomial value is multiplied by a base point of the elliptic curve group to respectively calculate a corresponding exchange value and generate a zero-knowledge proof corresponding to the cryptographic sharing unit and the server-side sharing unit and exchange them with each other; and The client host sets the third polynomial value calculated by itself as the client sharing unit, and the server host sets the third polynomial value calculated by itself and the received fourth polynomial value as the client sharing unit Add the formula values to calculate the corresponding shared unit of the server, and verify the zero-knowledge proof and calculate the shared unit with the client according to the exchange value and a Birkhoff coefficient of the client host and the server host and the threshold signature public key corresponding to the server-side sharing unit. The password-based threshold signature method of claim 6, wherein the client host and the server host are allowed to execute a password change function based on secure multi-party computation to replace the password with a new password, the replacement The cipher function contains: The client host prompts for the password and the new password, and randomly selects a b1 value and a b2 value, and then takes the password into the first hash function and multiplies the b1 value to calculate an old P value , and bring the new password into the first hash function and multiply the b2 value to calculate a new P value, and transmit the old P value and the new P value to the server host; The server-side host multiplies the k value by the old P value to calculate an old V value, and multiplies a randomly generated new k value by the new P value to calculate a new V value, and transmits the the old V value, the new V value and the public key to the client host; The client host takes the password, the old P value, the product of the reciprocal of the b1 value and the old V value into the second hash function to calculate an old password sharing unit, and the new password, the new The product of the P value, the inverse of the b2 value, and the new V value is brought into the second hash function to calculate a new cryptographic sharing unit; and The client host and the server host bring the old password sharing unit, the new password sharing unit, the t value of the threshold signature, the n value and the respective level value into the distributed key generation function to generate a client new shared unit of the client host and a server new shared unit of the server host, and replace the server shared unit with the server new shared unit, and generate a new shared unit with the client and a new threshold-type signature public key corresponding to the new shared unit on the server side.

Images